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31 October 1977 


MEMORANDUM FOR: Chairman, ICIS Task Force 


FROM: lee oe ae | 
IcIS Task Force 
Logistics Representative 


SUBJECT: ICIS Discussion Topics (AIUO) 


1. (U) This memorandum is written to surface certain 
specific problems which I believe worthy of discussion during 
our deliberations. Problems are identified by brief titles 
heading paragraphs which include skeletal narrative explana- 
tions. 


2. (U) Organization, Mission and Staffing of the 
Office of Logistics Security Staff (OL/SS) 

The Chief of the OL/SS has requested that the role yin 
and responsibility of his staff be reviewed to determine 
whether realignment of functions is in order. He also has 
recommended that his staff be augmented. His memorandun, 


along with a response from the Director of Logistics, is 
included for ICIS consideration as Attachment 1. 


5. (8S)  Statfinge: - OCC 


Mr. Blake has stated in paragraph 3(c) of his es 
16 September 1977 memorandum that "Statistical analyses yin 
should be undertaken to validate if the distribution of man- 
power for the three functions involved in the three different 
modes is in consonance with the workload to be carried by each 
mode.'' There is a fourth function, i.e., Office of General 
Counsel, which is critical in all of the three modes. That 25X14 
office has assigned only two attorneys to review thousands of 


contract actions, as well as handle all other logistics prob- 
complicated large cases such as the flaps on Ts 

i As an example, the number of funded contrac 

reviewed in FY 1976 was 3,668, while unfunded actions totaled 

2,441. It should also be pointed out that procurement dollars 


a 
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SUBJECT: ICIS Discussion Topics (AIUO) 


represented by these actions (even excluding national 
programs) represents one-half of the Agency's annual budget 
for other than personnel costs. The contract review by OGC 
is critical to insure that required clauses (security and 
other) are properly drawn and incorporated, and that the 
contract meets current legal and regulatory requirements. 

I believe a check with other agencies would reveal much 
greater allocation of resources to the function of legal 
support for the procurement function, and suggest that the 
application of manpower to the legal function may be a 
Suitable subject for consideration if we are looking at 

the entire process. 


4. (U) Competition vs Security 


The writer has been involved with the IC Staff in 
preparation of a general policy statement on procurement 
which will be signed by the DCI and promulgated to the 
entire intelligence community. The statement emphasizes 
the importance of competition and broadening the base of 
industrial contractors used by the community. It also 
establishes reporting requirements directed toward facili- 
tating measurement of progress on objectives. The Admiral's 
emphasis on competition is being carried out in actions by 
the Agency Contract Review Board and by the various require- 
ments units. While agreeing that the DCI's objective is 
worthwhile and consistent with procurement law, there are 
certain attendant problems which must be considered: 


a. Adding a new contractor to the stable of 
contractors, when compartmented clearances are 
required, requires dropping an equivalent number 
of clearances to be consistent with the Admiral's 
current direction. 


SECRET 
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SUBJECT: ICIS Discussion Topics (AIUO) 


b. Competitions (which involve compartmented 
clearances) require involvement of several con- 
tractors and even providing the contractor a copy 
of the request for proposal or inviting them to a 
bidders conference requires establishment of new 
facility and personnel clearances and dropping of 
existing clearances. 


c. Directorate representatives sitting as 
members of the Agency Contract Review Board have 
stated that certain acquisitions have a level of 
sensitivity/classification which will not permit 
competition. A possible solution has been suggested 
to them, i.e., identification of such items and 
appropriate documentation to the DCI for Head of 
Agency approval to handle those specific actions 
on a sole-source basis. 


d. The emphasis on competition should also be 
considered as a part of the ICIS deliberation on 
paragraph 3(c) on staffing. The competitive process 
requires more time on the part of technical officers 
in preparation of specifications and statements of 
work as well as in establishing evaluation criteria 
and the actual process of evaluating contractor 
proposals. Time is required for holding meaningful 
discussions with contractors in the competitive 
range and additional effort is necessary on the 
part of cost analysts as they may be asked to 
examine proposals of all contractors in the com- 
petitive range. 


5. (U) Contract Numbering System 


The DD/S&T-DEG contracting team has surfaced a 
problem on the Agency's contract numbering system which it 
feels may tend to compromise Agency association classifica- 
tion. The Office of Logistics has developed an interim 
solution to this problem; however, since the problem has 
been raised and is current, it is surfaced for ICIS infor- 
mation. Attachment 2 is the DD/S&T memorandum on this 
subject. 


SEGRET 
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(U) FOIA 


Many Agency contracts are written for which the 
association of CIA with the contracts is unclassified 
notwithstanding the fact that the contract may require 
work, reports and hardware which are Top Secret/Codeword. 
The schedule of such unclassified contracts must use 
certain language descriptive of the work to be performed. 
It also identifies the security classification of the work 
and provides information on contractor security require- 
ments. These contracts, as unclassified documents, must 
be provided upon request to any party making a request 
under the Freedom of Information Act. This is a problem 
in the sense that contractors doing highly classified 
work for CIA are easily targeted by the opposition. It 
even allows the opposition to prioritize its targets since 
Top Secret/Codeword projects will quite naturally be of 
greatest interest. 


7. (U) Contract Information Systems 


The DD/S&T has developed an automated system of 
storing and retrieving information on its contracts which. 
is identified as STEPPES. This system includes all DD/S&T 
contracts including national programs which are compartmented 
in a file identified as SPA. The Office of Logistics also 
has developed a management information system which includes 
all Agency-funded contracts (not national programs). Much @ 
of the information in the two systems is duplicative; however, 
the respective programs are significantly different as are 
the purposes of the systems. 


The lack of a single system for all contracts posed 
problems during the period when the Senate and House Committees 
were submitting frequent inquiries and prevents ready prepara- 95 x1 
tion of reports on the total Agency procurement process. 


Attachments 
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2 7 SEP 1977 


MEMORANDUM FOR: Chief, Procurement Management Staff, OL 


“FROM: James H. McDonald 
Director of Logistics 


SUBJECT: : Security Staff Augmentation and Role 
and Responsibilities of OL/SS 


REFERENCES: (a) Mult adsee memo dtd 16 Sept 77 fm 
A-DCI, subject: Comprehensive Review 
of Responsibilities for Industrial 
Contracts and Industrial Security 
(OL 7 4256) 


Memo dtd 22 Sept 77 to A-DDC€I fm 
A-DDA, subject, Comprehensive Reivew 
of Responsibilities for, Industrial 
Contracts and Industrial Security 

(OL 7 4256a) 


Memo dtd 19 Sept 77 to D/L fm C/SS/OL, 
subject: Security Staff Augmentation. 
(OL 7 4234) 


1. The Acting DCI, in referent (a), established the 
framework and principles for a survey of the industrial 
security and contracting function in this Agency. Referent (b) 
nominated you as the representative of OL. 


2. Referent (c) addresses a series of problems and 
conflicting roles and responsibilities from an ‘industrial 
security standpoint. I am inclined to agree with Jerry that 
there are often conflicting responsibilities as well as ill- 
defined ones in this area. .I also agree that the creation 
of a 20-man industrial security audit team to review and 
monitor the work implemented by a much- smaller security 
Staff puts the cart before the horse. A better division 
“Of assets seems more desirable. 


OL 7 4361 
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SUBJECT: Security Staff Augmentation and Role and 
Responsibilities of OL/SS 


3. When the Survey Group is established and a chairman 
appointed, it is my desire that you present the viewpoint 
outlined in Jerry's memo to the group for its consideration 
and review before final recommendations are made. 


25X1 
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SUBJECT: Security Staff Augmentation (U) 


rofessionals at Head aie Oe 
(3) cers assigne ng 


ay 3 Staff Position: ~ (c) te ds eee donate: to assume the : 
“developments noted above will affect the operation of the Indus - 
“ereet Securs ty Program in several Mays « * oe : 


Present ‘staffing ‘does not permit the. inspection of all 

contractors annually. It is recognized that certain contractors 
. due to the sensitivity of the work they are performing ‘should ‘be 
Amore) ee monitored than present resources permit. “a 


av ” ‘The ‘scrutinizing efforts of the Security Audit Group 
‘can only result in.the Staff being tasked to both account for as 
well as remedy. deficiencies which may be uncovered. It would be 
preferable if the Staff were in a position by more frequent - 
contact with a.contractor to ensure that security standards are 
being maintained and procedures were being. properly complied ° 
“ with. It is not toe inconceivable that- at some: point the indus- - 
~ trial security inspectors could be outdistanced (if not out- 
“-mumbered) by the “checkers™ once the Security. Audit Program is- 
euderway.: . tae Gite 
a The present Aeaise: focus on contractor facility secus 
rity acts to ignore another area of vital importance in the ~. . 
‘Industrial Security Program. Requiring equal attention. although 
frequently overlooked, is the continued need for the services of 
knowledgeable industrial security officers at the Headquarters 
-level who are responsive to Agency technical officers and con- 
.. tracting officers on security procedures relative to the various 
“ . types of procurement actions. Clearly, the industrial security 
7 coin: is two- -sided and both deserve our best efforts. 2: 
“ ~ 4 
A  eeeei ayy ésnsidetation. in the administration of. the 
Andustrial Security Program are the problems present by indis-~- 
“tinct channels for the command and control of personnel assets. 


-. » A case in point are the two SMS/DDS&T security officers located 
respectively, who: | 
exercise security control over Agency contractors where certain 


sensitive compartmented desormetten is involved. . These officers 


have no reporting respo 9 his Staff. This situation | 
is peculiar only to the . eee eee 


Hien tly Perhaps a ‘less exasperating problem but one which pre- 
“gents some concern is ne situation in the OD&E Contract Team. 
2 ‘ a : : | 
ie 
; “8 
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SUBJECT: Security Staff Augmentation (U) 


It appears that the security officer there serves several masters. 
Officially, he is on the Table of Organization of the Chief, OD§¥ - 
Security Staff, but has reporting responsibilities to this Staff . 
on Security matters pertaining ‘ANIME contracts We 25X11 
understand that he also handles certain National Program contracts 
or contracts which require access te National Program information. 
There is also some evidence of his involvement in bigot listed 
activities... A like situation also exists with the security offi- 
cer of the ORD Contract Team... His primary function is dgluted 

due to his additional ORD.area security duties. It is not enough 
to depend on the contracting officer and the contract team secu- 
rity officer to determine when-an activity. should come under the 
cognizance of this Staff. To do se allows for the creation of _ 
.too many grey areas and invites the potential for a flap. The 
high visibility industrial security matters currently enjoys... © 
would suggest that some revamping of functions and responsibil- 


ities may be in orders |. ~~... ... Oe ae : Le, 


. -. In this regard the question may be raised as to what... 
this Staff!s actual relationship should be to the. security offi- 
cers assigned to the contract teams. Do we have a direct respon- 
sibility for all their actions with respect to contractors or. 
should it be limited to providing security policy, guidance and 
support from Staff -resources? The degree of control which real- 
istically can be exercised by the Chief, Security Staff, and the 
breadth of his span of control would appear to be fundamental 

to this issue. The answers to these questions would have a 
bearing on the Staff's responsibility for ensuring that adequate 
staff is made available to perform the tasks assigned. If ad- 
‘ditional personnel are approved, this will allow more ‘responsi- 
bility and control to be placed in the OL/SS and will allow more 
time to be devoted by contract team security officers to the . 
initial stages of the procurene 


-+ S 
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3 November 1977 


MEMORANDUM FOR: ICIS Task Force Members 


eputy Uirector of Medical Services 


SUBJECT: Study Material - Commercial Systems and 
Audit Division's (CSAD) Participation in 
the Procurement Process (A/IUO) 


(A/IU0) Attached is a copy of the contribution of 


a °«< of Finance, in response to paragraphs 
3d, e, and f. As indicated iii paper, CSAD's 


audit schedule for the six months ended 30 September 1977 


is available for study in my office in Room 1D4061, Headquarters, 


dministrative-Interna] 
ro —\dminist : 
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ICIS TASK FORCE WORKING PAPER 
THE ROLE OF COMMERCIAL SYSTEMS & AUDIT DIVISION 


(CSAD), OFFICE OF FINANCE IN THE AGENCY'S 
PROCUREMENT PROCESS 


1. (A/IUO) The Commercial Systems and Audit Division (CSAD) of 
the Office of Finance plays an important role in the day to day procure- 
ment processes of the Agency. This component of the Agency should not 
be confused with the Audit Staff of the Inspector General's Office which 
is responsible for the post-audit of all Agency activities, including 
the procurement process. CSAD is a part of ongoing daily activities while 
the Audit Staff acts in an oversight capacity. 

2. (S) The major responsibility of CSAD is to assure that in 
cooperation with Agency contracting officers, the Agency gets the best 
possible goods and services at prices which are equitable both to contractors 
and the Agency. This involves major support to the contracting officers 
of the Procurement Division, Office of Logistics as well as to certain 
other contracting officers who have procurement teams in OSO, ORD, ODE, 

DDI and OTS. Activities of CSAD and its auditors include (1) services prior 
to the award of contracts (2) field audits of contracts and (3) participation 
and cooperation in Office of Logistics procurement policy determinations. 

3. (A/IU0) The audit activities of CSAD are outlined briefly as 
follows: 

A. Services Prior to Award of Contracts 
1. Surveying Contractors' Internal Controls and 
Accounting Practices including a review of 
their Accounting Systems, Financial Position 


and Costing Practices. 
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2. Analyzing Contractors' Cost Proposals 
3. Providing Accounting Counsel és Contracting 
Officers | 
4. Advising the Agency Contract Review Board on 
Proposals 
B. Field Audits of Contracts 
1. Reviewing Contract Documents 
2. Auditing Cost-type, Fixed Price Incentive  - 
and Fixed Price Redeterminable Contracts 
3. Auditing Overhead Expenses 
4. Providing Liaison with Defense Contract 
Audit Agency 
5. Providing Accounting Counsel to Contracting 
Officers on Contract Settlement 
C. Participating in Office of Logistics Activities by 


Attending Procurement Officers and Procurement Policy 


Panel Meetings 


25X1 
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5. (U/AIUO) A recent development in government contracting is 
the formation of a Gost Accounting Standards Board which is chaired 
by the Comptroller General of the United States. As a result of the 
activities of the Board, most large contractors are Heaitnedcts submit 
comprehensive "Disclosure Statements" relative to their cost accounting 
systems. Consequently, CSAD is becoming more involved in policing the 
Cost Accounting Standards Board's promulgations and standards. This is 
requiring more audit time and will pe [an area of expanding coverage 
for CSAD auditors. | 

6. (U/AIUO) Another recent development in procurement is a 
"Truth in Negotiation" law which requires that when a negotiated contract 
exceeds $100,000 the contractor must be willing to make available to the 
contracting agency all the facts upon which it based its price quotation: 
Current law provides for audit of this data for the purpose of recovering: 
any excessive profits=:caused by the use of defective or inaccurate pricing 
data. CSAD is involved in this type audit because on occasion there may 
be a real "payoff" in following up on such contracts. 

7. (A/1U0) A further development which has occurred within the Agency 
is the determination that there will be greater competition in Agency 
procurement. In instances where "sole source" procurement was generally 
accepted we may now have two or three or more contractors submitting pro- 
posals which require analysis. | 


8. (S) Two branches of the Commercial Systems and Audit Division 


provide support to the Office of Logistics in its procurement activities. 


1A 
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9. (U/AIUO0) Auditors perform pre-award surveys for the purpose of 
assuring the contracting officer of the. financial capability and responsi- 
| bility of a proposed contractor and also to determine that the cost-accounting 
system of the contractor will appropriately accummulate the cost data required 
on a proposed contract. "Interim audits" (while contract performance is 
in progress) are performed when possible or necessary and "final audits" 
are performed prior to the final cat or price determination and the closing 
of a contract. 
10. (S) During the year ended 30 September 1977, CSAD (exclusive 
of the auditors assigned to teams) completed the following: 
Financial and Accounting Systems Surveys 25X1 


Audits of Fixed Price Redeterminable and 
Incentive Contracts 


Interim Cost Audits 

Final Reports on Cost Type Contracts 
Overhead Determinations: 

Reviews of DCAA Determined Overhead Rates 
Analyses of Cost Proposals 


TOTAL REPORTS ISSUED 
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11. (S) As @€ 30 September 1977 CSAD had on hand [MMMM contracts 25X11 


and 269 task orders total | ing [is Unaudited 25X1 
claims were approximately 


12. (U/AIUO) CSAD's audit schedule for the six months ended 30 
September 1977, which reveals the magnitude of the audit task, is on file 
in the Office of the Chairman of our Task Force. The schedule for the 
period 1 October 1977 to 31 March 1978 will be made available in the near 


future. 


aN Es! 
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4 November 1977 


MEMORANDUM FOR: Chairman, ICIS Task Force 


CIS Task Force 


Logistics Representative 


SUBJECT: Paragraphs 3(d), (e), and (f) of A-DCI 
Memorandum dtd 16 Sep 77, Subject: Com- 
prehensive Review of Responsibilities 
for Industrial Contracts and Industrial 
Security 


1. Specific paragraphs identified in the subject query 
whether the Directors of Logistics and Security, and the 
Chief of the Audit Staff: (a) maintain sufficient oversight, 
(b) have sufficient access to continuing information to make 
reasoned judgments, and (c) whether there exists sufficient 
on-site reviews, inspections and audits at Headquarters and 
field levels for functions for which they are held respon- 
sible by Agency regulations. This memorandum identifies the 
responsibilities for which the Director of Logistics is 
responsible (having to do with the three contracting modes) 
under CIA regulations and discusses existing overview, access 
and inspection. 


2. Headquarters Regulation [BM (attachnent 1) states 
that "The Director of Logistics ercise all delegable 
procurement authority of the Director of Central Intelligence 
as otherwise specifically delegated by the Director." It 

goes on to state that such procurement will be accomplished 

in general conformity with the procedures and standards by 
which Federal procurement is conducted by the General Services 
Administration or the Department of Defense as evidenced 
respectively by the Federal Procurement Regulations (FPR) and 
the Armed Services Procurement Regulations (ASPR) as they now 
exist or may be amended. A revision to this HR, which is still 
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SUBJECT: Paragraphs 3(d), (e), and (f) of A-DCI Memorandum 
dtd 16 Sep 77, Subject: Comprehensive Review of 
Responsibilities for Industrial Contracts and 
Industrial Security 


in coordination, will state that Agency procurement will be 
accomplished to the maximum practicable extent, in accordance 
with the ASPR except in those areas such as acquisition of 
ADPE, where the FPR is applicable for all Agencies. Copies 

of the ASPR are in the hands of all procurement units and 
Defense Procurement Circulars (DPC), which provide current 
update to ASPR, are distributed to all procurement activities. 
Since the Procurement Division in Office of Logistics (OL) buys 
ADPE, that organization is the only unit maintaining a current 
FPR. Procurement Notes (copies provided to Chairman ICIS as 
Attachment 2) issued by the Director of Logistics (D/L) provide 
direction to the contracting activities on Agency procurement 
policy. Specific written delegation of procurement authority 
(available at various procurement activities and Procurement 
Management Staff (PMS), OL) are issued to the chiefs of the 
various elements. 


3. The principal of "management by exception" is basic 
to operation of the procurement activity with the several 
contracting elements executing their procurement responsibility 
autonomously in accordance with their delegation of procurement 
authority. The exception to this autonomity is that any 
procurement action or contract am xpected to be 
or more in value, and overruns oli 15 percent must 

eview 


be reviewed by an Agency Contract oard_which is advisory 


to the D/L and operates in accordance with HR RR Attachment Ss 


This board does not review or challenge requirements established 
by technical officers but does review all aspects of the planned 
procurement in terms of good procurement practice and compliance 
with applicable laws and regulations. 


4. The D/L has also directed that the PMS/OL "Perform 
periodic reviews for the D/L of the several decentralized con- 
tracting teams, and the Procurement Division, OL." This 
direction is included in Logistics Instruction 1-15 (Attachment 
4). The Agency Audit Staff reviews all contract team operations 
annually, and the results of these inspections are fed back to 
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SUBJECT: Paragraphs 3(d), (e), and (f) of A-DCI Memorandum 
dtd 16 Sep 77, Subject: Comprehensive Review of 
Responsibilities for Industrial Contracts and 
Industrial Security 


the D/L. Additional checks and balances or reviews occur as 
representatives of the Logistics and Procurement Law Division 
of Office of General Counsel (OGC) review all contract actions, 
and representatives of the Commercial Systems and Audit Dava- 
sion (CSAD) of Office of Finance perform cost/price analyses 
and audit of proposals and contracts. While these functions 
are advisory to the contracting officers in the execution of 
his responsibilities, the CSAD reports through administrative 
channels any action of the contracting officer which ignores 
their recommendations and has negative impact on Government 
interest. 


5. The D/L is also charged by un ic various respon- 25X1 
sibilities necessary for implementing and ensuring adherence 

to the policy and standards pertaining to industrial contrac- 
tual arrangements established by the Director of Security 
(D/Sec). The Security Staff in OL and security representatives 
assigned to each of the decentralized contracting elements 
review contract actions expected to include classified elements 
to ensure compliance with D/Sec requirements. These security 
representatives, in addition to reviewing contracts and pro- 
viding advise and counsel to contracting officers, perform 
inspections of contractor facilities and maintain records of 
contractor facility and personnel clearances. 


6. An additional management tool utilized in management 
of contracts executed under the authority of delegations from 
the D/L is the OL Contract Information System (CONIF). Data 
is input to this system with production reports issued to all 
contracting elements monthly which provide ready reference 
to contracting officers on important elements of the contract 
process. 


7. One important aspect of the overall Agency system is 
the fact that boiler plate contract clauses (mandatory ASPR 
and Agency clauses) are prepared by the PMS/OL in coordination 
with OGC which are included as a part of every contract and 
which may not be modified without approval. 
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SUBJECT: Paragraphs 3(d), (e), and (f) of A-DCI Memorandum 
dtd 16 Sep 77, Subject: Comprehensive Review of 
Responsibilities for Industrial Contracts and 
Industrial Security 


8. In summary, the D/L believes that he does have 
sufficient oversight of the discharge of functions for which 
he is held responsible under Agency regulations. There is 
sufficient access to continuing information to make reasoned 
judgments as to how functions are being discharged, and there 
are sufficient on-site reviews, inspections, and audits. 


9. Noting the affirmative response in paragraph 8 above, 
it should also be noted that discussion in this paper refers 
only to two of the three modes which ICIS has been asked to 
consider. While the OL provides contracting officers to the 
contracting elements in the National Programs, it does not 
set procurement policy for those elements nor does it monitor 
in any way their performance. A discussion of the differences 
between the two systems of contracting is included in a paper 
entitled, "CIA Dual Delegation" which was prepared for sub- 
mittal to the Executive Advisory Group. That paper has 
previously been provided to you as Exhibit 6 to my memorandum 
dated 4 November 1977. 


ne 
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INSTRUCTION NO. LI 1-15 
LI 1-15 ORGANIZATION 
Revised 1 March 1976 


SUBJECT: Mission and Functions, Procurement Management Staff, OL 


1. MISSION 


The Procurement Management Staff, Office of Logistics (PMS/OL), 
Shall assist the Director of Logistics (D/L) in discharging his 
responsibilities as the Agency senior procurement officer. This 
staff will serve as a policy, procedural, and coordinating 
mechanism on behalf of all Headquarters and field contracting 
ATINTLunits having delegated authority from the D/L, will perform 
certain functions of a common-concern nature, will establish 


and conduct external re and — | staff cognizance 


2. FUNCTIONS 


The Chief, PMS/OL, shall: 


a. Function as the principal staff officer to the D/L in all ye 
Matters relating to those procurement functions which have been 
delegated to the D/L. This shall include the following: 


*(1) Serve as principal advisor and consultant to the 
Chairman, Agency Contract Review Board, and assume _ 
the duties of the chairman in his absence. Provide 
services as a secretariat to the Board. 


Serve as the senior Agency representative on all 
governmental and industrial committees concerned 
with procurement. 


Prepare special studies, reports, and inquiries, 
as required by the D/L. 


Serves as Agency principal representative to the 
Office of Federal Procurement Policy and act as 
focal point for all required interface. 
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, b.-’ Provide administrative oversight for those Agency pro- 
om curement functions which have been delegated to the D/L 
and coordinate such other procurement functions as 
directed from time to time. These shall include the 

following: 


*(1) Serve as the Chairman, Procurement Policy Panel. 


*(2) Interview and recommend potential candidates for in- 
clusion in the procurement career system. Serve as 
a member of the Logistics Career Service Board to 
develop recommendations on rankings of personnel, 
asSignments, and training and review recommendations 
of subpanels. 


Provide administrative support to the D/L and pro- 
curement officers by means of monthly statistical 
reports, special reports, and ad hoc inauiries based 
upon information contained in. the CONIF procurement 
data bank. ‘ 


Perform periodic reviews for the D/L of the several 
decentralized contracting teams, a: the 

Procurement Division, OL. 

Provide administrative support and direction to the“ 

Chief, who will report to the D/L via the Chief, 

PMS/OL. The Chief, PMS/OL, wj establish and maintain 

a coordinating role between and all Headquarters STATINT 
contracting teams and directorate elements associated 

with the procurement functions. 


Develop and monitor the implementation of procedures 
and practices designed to increase the efficiency 
of the procurement system and procurement personnel. 


Develop, manage, and administer "The Project Officer 
in the Contract Cycle" course. 


Exercise contracting officer authority on special programs, 
as directed by the D/L. 


d. Provide services of common concern to those elements of 
OL, the several decentralized contracting teams, and other 
Agency components concerned with procurement including 
the following: 
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_ Provide a point of contact for contractors attempting 
to establish a business relationship with the Agency 
through the procurement process. 


Act as the focal point for actions involving 


(a) patents and rights-in-data arising from Agency 
contracts, 


preparing and maintaining current contract general 
provisions, clauses, and forms, 


reporting the overall status of Government - 
furnished property, 


obtaining ratings under the priorities and 
allocations system, and priority assistance 
as requested, 


(e) processing contractor requests for access to the- 
ASTIA (DOD) system, and 


(f) Agency compliance with Equal Employment 
Opportunity requirements in industrial contracts. 


Develop and implement CONIF as a management information 
System including requirements and procedures, conduct 
of training courses, and preparation of manuals, etc. 


Maintain and operate the D/L terminal utilized for the 
CONIF System. 


Procure novelty searches for inventions claimed by 
Agency employees and pursue, as appropriate, the patent 
Drocedure through coordination with patent attorneys, 
the Patent Office, and the requesting component. 


Administer and provide management support for training 
courses for technical personnel who are involved in 
the procurement process. 


Review and analyze proposed and enacted legislative, 
executive, judicial, and administrative requirements 


in the Federal procurement field to determine 
applicability to Agency procedures. 
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(8) Review and recommend action on requests for 
approvals to contract with educational institutions 
and monitor compliance with Agency policy in this 
area. 


Supervise and administer the Procurement Management Staff, 
OL, as necessary. 


*Those functions identified in the previous sections with an 
asterisk shall be handled personally by the C/PMS and may STATINT 
not be delegated without the approval of the D/L. 


Director of Logistics 
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Aubrey - 


I hope the attached comments are useful to you. 

The only conclusion I can reach at this time is that the 
Audit Staff would require more auditors to do the work we think 
should be done. It is not feasible to guestimate a number at 
this time. The conclusions of the Task Force would have a direct 
bearing. 

With respect to recommendations, I think it would be pre- 
mature to make any. I would prefer to wait until the discussion 
phase is completed. 

I'll be back from my trip on Wednesday AM. If I can be of 


any help then, please call. 


Jerry 
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The Audit Staff does not have sufficient resources to review 
the procurement processes to the extent we consider necessary. 
We previously reported our scope of audit. This paper identifies 
areas where we believe the audit processes should be strengthened, 
The list may not be complete. The task force may identify 
other areas where additional audit is required. 
1. Discuss and review technical evaluations with Contract 
Officer Technical Representative (COTR). 
Note: This procedure has been followed in the past 
but only on a very few occasions. 
What homework has the COTR done to identify 
contractors in the field? Has the work been 
done before? Is another component actively 
engaged in a similar contract? 
Does the price proposed seem reasonable? 
Are there competitive proposals that can be 
used for comparison? 
Has the COTR reviewed the cost proposal by 
cost element? 
Review process of determination of adequacy of proposals. 
Review for duplication of effort. 
Review processes leading to determination of using 
Agency personnel vs. contracting out. 
Visit contractors to answer questions: 
a. Did technical direction contribute to the large 
number of changes? 
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To what extent were the changes-necessary to 


meet program objectives? 
Could the changes have been avoided? 
Was the Agency attempting to do more than was 
required? 
How do contractor personnel feel about type of 
contract negotiated? 
Would an administrative contracting officer placed 
at the plant have increased efficiency? 
g. Are security procedures satisfactory? 
Determine degree of compliance with EEO requirements. 
Evaluate controls over GFE used in Agency and National 
Programs? - 
Determine extent of training in the contracting area. 
Coordinate audits of contracts containing GFE to 
Property Supply Office (PSO) records. National Pro- 
gram contracts do not specifically state what GFE will 
be furnished in most cases. There is usually a standard 
paragraph referring to the PSO, 
Review the cause(s) of overruns. 
Review for compliance with OSHA laws. 
Test and review the procedures related to potential 
conflicts of interest in the procurement processes. 
EDP Software. 
a. Review the need for the EDP software system 
development. 


(1) Examination of the feasibility study for 
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proper justification, cost estimates and 
approval. 
Review hardware requirements for the pro- 
posed software system for cost, and the 
software impact on existing hardware. 
Examine the justification for using a contractor 
rather than doing the programming in-house. 
Define the problem in sufficient detail in the 
specification in order that the Request for 
Proposal can receive wide range of potential 
bidders. 
Review the monitoring by the technical officer 
during the progress of the contract. 
(1) Are contractor's programming techniques 
structured or module, 
(2) What language is the contractor using? 
(3) Test contractor's results to insure that 
program meets core storage constraints, 
CPU time requirements, and program specifi- 
cations. 
(4) Document contractor software with programmer 
remarks, flow charts, systems design comments. 


Evaluate the test results of the newly developted 


software during simulation and parallel phase. 


Hardware. 
Review the justification for acquiring by lease 


or purchase EDP hardware. 
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Examine the detail proposal submitted to vendors. 
Review the selection panel decision and justifi- 
cation for the hardware selected including the 
panel decision not to go through GSA, 

Review the test results performed by the con- 
tractor and the test conducted by the center 
personnel. This includes both bench test at 

the factory and the on-site testing. 

Evaluate the hardware impact on the software 
requirements and vice versa, 

Examine the cost estimates in the original pro- 
posals and the acttial cost of acquiring the hard- 
ware. Determine if actual cost is in accordance 
with GSA schedules. 

Review management decision regarding the purchase 
or continued leasing of hardware, especially when 


the GSA procedures recommend procurement, 
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As previously reported, the Audit Staff has not been denied 
access to information. Nevertheless some comments are appropriate. 
Audit Staff is responsible for the audit of some major pro- 
grams. A few of the programs are so large as to suggest a need 
for continuous monitoring (by audit) rather than just a periodic 
review. The benefits to be derived from continuous monitoring 
include: 
more timely opportunity to offer constructive 
comment 
better audit scheduling to minimize inter- 
ference during critical operation periods 
- better allocation of audit resources. 
The need for continuous monitoring has been perceived but not 
pursued. The need has not been pursued primarily because of a 
lack of audit resources. 
There is an additional area relating to access of continuing 
information. The decision making processes in the Directorate for 


Science and Technology culminate in a quarterly review during which 


the DDS&T or his deputy give final approval before an action is 


initiated. Audit has very limited access to this process. There 
generally is little written material related to the process which 
is available for subsequent review by audit or other independent 
groups. Again the lack of audit resources has limited our pursuit 
of this matter. The process will warrant attention however as 


audit becomes increasingly concerned about program results. 
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As previously reported, the General Accounting Office has 


identified three elements of audit, the third of which is con- 
cerned with results. The process calls for a determination 
whether the desired results or benefits are being achieved, 
whether the objectives established by the legislature or other 
authorizing body are being met, and whether the Agency has 
considered alternatives which might yield desired results at 
lower cost. Regardless of who audits for program results, 


the evidence should be available for review. 
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Audit experience to date indicates a need for on-site 
field reviews at the field level. Our experience in this area 
has been limited. But the results of our experience have been 
positive. Again, as we become more concerned with economy and 
efficiency and program results, the benefits to be derived from 
visits to contractor plants should become more manifest. 


Audit should become more aware of such things as the: 


- relationship between the Government and 


the contractor 
- extent of compliance with laws required 

of Government contractors but which are 

not examined for compliance by DCAA auditors 
- €xtent of compliance with industrial security 


practices. 
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Paragraph 4a can best be answered by Security. 


Audit does retain a responsibility to report the effec- 


tiveness of agreed upon industrial security procedures to 


management. 
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Audit is satisfied that there is a proper distribution of 
responsibility between the functions performed by the DCAA 
auditors and the Audit Staff. 

Audit Staff is concerned that many officials of the Agency 
do not understand the role of the two audit functions. To 
correct this situation, the Audit Staff conducts a continuing 
informal educational program. 


The Audit Staff in 1974 discussed the alternative means 


by which National Program Contracts could be audited. There 


have been no changes. The subject should be considered again. 
For many years there has been limited coordination between 
the Audit Staff and the DCAA auditors. Audit Staff reviewed 
DCAA reports. On occasion there has been some discussion on 
topics of mutual concern. On a few occasions the results of 
the liaison between the two audit groups resulted in cost savings 
to the Government. 
As both audit staffs apply greater resources to program 


results audits, the need for increased liaison will grow. 
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The Audit Staff is not in a position to document an answer 
to the question. There has never been an audit conducted to 
address the issue. Based on observations, however, the answer 
is no. 

The CONIF and STEPS system come closest to addressing the 
issue. But neither system was designed to enable the Agency 


to speak with one voice to the contractor. 
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ICIS TASK FORCE WORKING PAPERS 


OFFICE OF COMMUNICATIONS 


(C) Office of Communications' responsibility for negotiating 
the establishment of communications facilities at Industrial 


Contractor sites is contained in i Attachment A 25X1 


1A (C) There are currently Bh scency sponsored communications 
centers located at Industrial Contractor sites. Cryptographic 
equipments and materials are provided and controlled by the 
Office of Communications in accordance with national policy 
direction of the United States Communications Security Board 
(USCSB). Attachment B. The selection of equipment, installation 
criteria, area of control and security safeguards are the same 

as those prescribed for CIA staffed domestic communications 
centers. 

(C) New requirements to establish communications centers 
at contractor sites are received by OC from the sponsoring 
Agency component. The request specifies the type of communi- 
cations service required, the security level of material to be 
handled, cost center information, and the name and clearance 
status of contractor employees with whom OC will coordinate 
the installation. OC, in coordination with the Office of 
Security, conducts an initial site survey at the contractor 


facility to verify that suitable space is available to install 


re 
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the communications center. Arrangements for any necessary 
structural renovations, power requirements and special security 
considerations are coordinated with appropriate contractor 
personnel during the initial site survey. The sponsoring 
Agency component is advised of the results of the survey and is 
provided a cost estimate covering communications equipment, 
circuitry, installation and related costs. 

(C) Contractor communications centers supporting joint 
CIA/NRO projects are managed by a small staff of OC personnel 
assigned to the Office of SIGINT Operations (0S0), DDS&T. 

All operational, security, training, equipment installation 
and maintenance support is provided by that staff. Non-NRO 
related contractor communications centers receive similar 
operational, security, training and technical support from 
contractor communications centers are provided a copy of 
OCHB 10.10.10 (KW-7 Operating Instructions) and a copy of 
OCHB 10.80.4 (COMSEC Material Control System). Attachment C. 
These documents are supplemented by procedural guides and 
message preparation instructions unique to a particular 
project or type of traffic being handled by the contractor 


center. 
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(C) All contractor communications centers, with one 
exception, are staffed by personnel in the direct employ 
of the company involved. The personnel are selected by the 
contractor Security Officer and are subject to a background 
investigation conducted by OS. Cryptographic clearances are 
granted to contractor personnel based on a favorable OS 
background investigation and compliance with USCSB and CIA/OC 
policy. Office of Communications staff officers train 
contractor personnel in the operation and security implications 
of cryptographic equipments and in the use, control and 
destruction of cryptographic materials. Periodic and unannounced 
inspections are conducted at each contractor site to ensure 
compliance with security standards and to inventory cryptographic 


equipments and materials. 


nam 
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RESPONSIBILIT Big 


The Director of Security has already set in motion programs designed 
to carry out his industrial security responsibilities. This interim 
report on industrial security tdememiews was written,ii" thé ‘midst of a 
fluid security management situation. An Industrial Security Branch has 
been formed and has:-already begun to conduct security audits of contractor 
facilities, replacing the ad hoc security teams which had begun the audit 
program. As a matter of first priority it is eff» drafting a consolidated 
Industrial Security Manual. It will also act as an Office of Security 
focal point for providing advice and guidance to the Industrial Security 
Officers (ISO's) assigned to contracting components; establishimg a formal 
training program for ISO's; and creatmmg a centralized reference index 
of security information on contractor facilities and contractor-personnel 
involved with all Agency contracting components. 


Security personnel in the industrial computer security field and 
‘compartmented security policy and access control areas have been augmented. 


These additional security capabilities will obviously play an important 
role in industrial security and must be read into any assessment of the 
Agency Industrial Security Program as it now exists. 

PoLicy STANDARDS aud “PROCEDURES 

By regulation, the Director of Security has the function of developing 
and publishing uniform security policy and standards for the establishment 
and maintenance of the security of Agency industrial contract arrangements. 
He also has the regulatory function of providing security guidance to 
unspecified national intelligence programs. 


Security policy and standards for the contracting programs % conducted 
by the Office of Logistics and by the contracting teams have been developed 
by the Security Staff of the Office of Logistics and published, after review 
and approval by the Director of Security, in the form of two industrial 
security manuals. The manuals are essentially the same, varying only in 
that one goes to contractors where association with the Agency is classified 
and one to contractors where it is not. Copies are given to contractors 
and incorporated into a contract by reference. 


/, Pou Cr, and Standards 
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Where Office of Logistics, ccntracting teams and national level 
programs enter into contracts involving SI/TKH material, they follow 
policy and standards developed by the Special Security Center of the 
Office of Security and published, after review and approval by the Director 
of Security, in an industrial security manual specifically tailored to 
Agency contracting. This manual is designed for the use of Agency 
employees. It is not given to contractors but pertinent portions may. 
be furnished to contractors for their guidance and for inclusion in con- 
tracts where necessary. 


National level programs obtain the balance of their guidance con- 
cerning industrial security policy and standards from the Special Security 
Center in the form of the§Jodustrial Security Manual which, after 
review and approval by the Director of Security, was published in order 
to establish guidelines, philosophy and requirements for safeguarding 

information in the possession of contractors. Copies of the manual 
are incorporated into contracts by reference. STATINTL 

Underlying the physical security standards in the oa SI/TKH © 
manuals is the USIB Physics! Security Standards Policy Statement which 
provides "minimum standards" applicable to contractors. A representative 
of the Director of Security served on the USIB committee watch produced 
these ‘standards. 


At the present time, the manuals contain some discrepancies in 
standards or requirements but, more Amportantlys each manual contains 
language like the following: 


"Specific requirements ... will vary from contractor to 
contractor ... the proper combination of techniques and the 
degree to which they will be employed can best be determined 
during the ... Security Representatives ... visits and 
inspection .... There are, however, certain ... minimum 
standards which remain reasonably constant." 


This language obviously envisions permitting the Industrial Security 
Officer to make independent judgments on-site consonant with such consi- 
derations as cover. To the extent, however, that these judgments or 
tradeoffs vary from accepted standards they are reported to the appro- 
priate Program Security Desk or on to the Chief of the appropriate 
Security Staff along with a request for approval. They do not have to 
be reported to the Office of Security unless SI/TKH material is involved 
(where the Special Security Center must sign off), or where in the 
judgment of the respective security staffs, a significant policy question 
requires the attention of the Director of Security. 


Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 


Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 
-3- 


While only one of the three regulatory responsibilities given above 
contains the word "uniform", an attempt to achieve uniformity by means of 
a consolidated Industrial Security Manual is being undertaken by the newly 
created Industrial Security Branch as a matter of first priority levied 
by the Director of Security. 


ATINTLg, PROCEDURES 


DF 0k PATRAS ae 


(2) Functions. The Director of Security will: 


(b) obtain and evaluate through investigation, polygraph 
interview, and liaison contact with other United States agencies, 
pertinent information regarding personnel for employment, assign- 
ment or association with the Agency. 


(2) The Director of Security is responsible for: 


(c) Conducting security investigations and evaluations 
and furnishing the Director of Logistics with precontract and 
contract industrial security approvals. 


The standards for security investigation and evaluation for contractors 
involved with the Office of Logistics and the contracting teams are con- 
tained in HR hile those for national program contractors and con- 
tractors in ree modes where SI/TKH is involved are contained in 
DCID 1/14. While there are differences, they are not substantial and 
the Director of Security has prepared a formal guide for the Industrial 
Security Desk in the Clearance Division which brings the two standards 
into synchronization. (The Office of Security formerly had two completely 
‘separate evaluation units to handle national programs and Office of 
Logistics requests. ) 


Le! 7 


(2) The Director of Security is responsible for: 


(b) assigning career security officers to the Office of 
Logistics and to directorates where contracting officers are 
assigned for duty. 


Prior to assignment to the Office of Logistics, contracting team, 
or national program, candidates for these positions are screened by Panels 
and the Office of Security Career Board (each of which contain officers 
who have served extensively in one or more of the three contracting 
modes) and nominees for assignment are sent to the Director of Security 
for his personal concurrence. 
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The key assignments that the Director of Security makes are the 
Chief, Logistics Security Staff and the Chief, OD&E Security Staff with 
the Chief/DDS&T Security Management Staff playing an important role at 
a different level. Carefully selected, highly experienced security 
officers, these individuals act for the Director of Security in implementing 
policy and making the industrial security system work. 


What formal reporting is required flows from the Industrial Security 
Officer to his component. Communications with the Director of Security 
consist of seeking guidance from or passing information to him on an 
incident or case-by-case basis. The interchange is flexible, fast and 
informal. As experienced officers, the Seaurity Staff Chiefs can go to 
any portion of the Office of Security for appropriate guidance or go 
directly to the Director of Security. Conversely, the Director of Security 
confers directly with the Staff Chiefs when he wishes to give them guidance 
or obtain information. 


This same type of relationship exists between the Staff Chiefs and the 
Industrial Security Officers. Security advice and guidance is usually 
scught on a case-by-case basis and given in the same véin. 


The Industrial Security Officer is an active participant in the 
classified contracting team concept in all three modes. The more conversant 
he is with the technical aspects of his contracts, the more effective he can 
be in working up security plans and providing guidance. The relationships 
he creates with his contractors go a long way toward determining how much 
feedback and knowledge the contracting components and the Director of Security 
obtain regarding incipient or active security problems -- it must be a 
carefully nurtured, professional relationship, establishing a working 
rapport of mutual problem solving. Once established, this relationship 
fills an informational and timliness need which no formal inspection system 
can ever provide. 


A formal training program for Industrial Security Officers will be 
activated by the newly established Industrial Security Branch. At this 
point in time, training is almost exclusively of the on-the-job variety 
given by experienced Industrial Security Officers. 


Fitness reports are prepared by the component in which the Industrial 
Security Officer serves. Promotions remain the province of the Director 
of Security as does rotation, although the latter is always in consulta- 
tion with the component involved. 


(a) Functions. The Director of Security will: 


(f) make necessary inspections, investigations-and reports to 
assure proper maintenance of security ... 
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(2) The Director of Security is responsible for: 


(d) Performing physical security inspections when considered 
necessary, consistent with the primary inspection responsibility 
of the Director of Logistics .... 


In the Office of Logistics and contracting team areas, the Industrial 
Security Officers attempt to conduct annual inspections of those contractor 
facilities under their respective cognizance which possess or produce 
classified material. In the national programs, no formal inspection cycle 
is established, it being felt that,given the manpower limitations,the visrts wade Ty 
the grim Sokal een of problem solving J ein contractors and Industrial Security 
Officers provides reasonable oversight. All three modes feel that current 


manpower precludes conducting thorough, frequent inspections. 


a TINT, QMERSIGHT 
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@ (2) Function. The Director of Security will: 


(u) determine the effectiveness with which security programs 
and policies are being accomplished and institute or recommend, 
as appropriate, improvements where needed. 


The Director of Security doesnot ‘havé..a :formal, “established” feedback 
system-to-tell him how everything is going. He does have an informal 
system which appears to work well in what is often called operational 
security. This usually starts with the contractor himself or the cogni- 
zant Industrial Security Officer. Flaps and serious policy problems of 
all sorts in physical, technical, and personnel security areas flow rapidly 
through the security network providing information and opportunity for 
the Director of Security to be aware of deviations, make reasoned judgments 
and reach timely decisions. The system is fast, flexible, free of protocol, 
and quick responding. 


It is at a level below this - the day to day decision making level - 
that the system lacks consistent oversight. Much of this type of informa- 
tion will be provided in a thorough manner, but at a much slower pace, 
by the new Industrial Security Branch in the course of security audits of 
sensitive contractor sites. Nothing, however, will provide a satisfactory 
substitute for active participation by the security offices directly involved 
in the contracting process. 


The Industrial Security Staff Chiefs and Desk Chiefs feel the need to 
get out more and observe the system in action. They feel more spot checks 
are needed. They feel constrained, however, by the need to be available 
to respond to immediate needs as they arise. Much of this inability to 
participate more actively is attributed to a lack of manpower. This 
perceived lack may be caused by insufficient manpower investment within 
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Wat" the contracting components. It may be a result of inefficient work- 
load distribution and lack of interchangeability due to such things as 
necessary compartmentation, unmecessary compartmentation, cover, and physi- 
cal dispersal of officers who, if collocated, could pool office coverage 
and permit greater participation in on-site contractor security activities. 
It is probably a combination of both insufficient manpower and inefficient 
utilization of resources. 


% 

Assessing this problem, determining an effective manpower level, 
recommending realignments or adjustment, and then, through adequate over~ 
sight, continuing to test the validity of the industrial security program 
structure presents the primary security management challenge to both the 
Director of Security and the contracting components. 


Cc » ENFORCEMENT 
eat aa Me] 


Under a delegation from the Director of Central Intelligence, the 
Contracting Officer is responsible for all aspects of contract adminis-— 
tration, including enforcement of the contract provisions. In order for 
him to exercise this enforcement responsibility in the security portions 
of the contract the Contracting Officer must have knowleable, continuing 
oversight of the contractor facility which will identify for him security 
policy deviations and procedural deficiencies. Since the Industrial 
Security Officer at the component procurement level and the Office of 
Security audit teams are in the best position to provide this oversight, 
the responsibility to do so should be clearly placed with the Director of 
Security. To meet this responsibility, the Director of Security will need 
clear regulatory recognition of an overall coordination responsibility for 
the Industrial Security effort. 


While this arrangement will not, literally, give prime responsibility 
over enforcement of security standards prescribed for CIA.contractors to the 
Director of Security, it will accomplish the desired goal by insuring 
adequate oversight over contractor security performance. All deviations 
and deficiencies would be noted, discussed with the contractor, recorded 
and forwarded to the responsible Contracting Officer for enforcement action. 
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RESPONSIBILITY 


A. Policy, Standards and Procedures 


The Director of Communications is responsible by regulations 


for negotiating the establishment of communications facilities at 
industrial contractor sites, in coordination with Agency components 
concerned. 

Cryptographic equipments ‘and materials are provided to contractor 
facilities by the Office of Communications in accordance with national 
policy direction of the United States Communications Security Board 
(USCSB). The selection of equipment, installation Standards, area of 
control, and security safeguards are the same as those prescribed for 
Agency staffed domestic communications centers. 

All contractor communications centers, with one exception, are 
staffed by personnel in the direct employ of the contractor involved. 
Cryptographic clearances are granted to contractor personnel based on 
a favorable background investigation by the Office of Security and 
compliance with USCSB policy. Office of Communications staff officers 
train contractor personnel in the operation and security implications 
of cryptographic equipments and in the use, control, and destruction 
of cryptographic materials. All contractor communication centers are 
provided operational documents applicable to the particular crypto- 
graphic system and exappesseei materials for which they are respon- 
sible. These documents are supplemented by procedural guides unique to 
a particular program or type of material being handled by the contractor 


center. 


Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 


Approved For Release 2001/11/08 : CIA-RDP96B01172R000700010001-4 


2 B. OVERSIGHT 
STATINT 


Management of contractor communications centers is shared by two staffs. 


ATINTL 


Centers supporting Agency programs are managed by oe 
re «:.: oversight by the Director of Communications. Centers 


supporting national programs are managed by the Communications Support Staff, 
Office of SIGINT Operations, DDS&T. An informal exchange of information 


And Un) fore Communications SEC HRITY 377i Beds 
exists between these staffsoame Tiare a Sa etert pbONET 


ARO ON (ORC aT Eb Cm rRraerern CEnFtAS, 
centers: However, the Director of Communications does not have regulatory 


responsibility for QuERS/ IMT sn of communications security omennnsiegirt 
at centers supporting national programs. 

Periodic and unannounced inspections are conducted at ail contractor 
sites to ensure compliance with communications security standards and to 
inventory cryptographic equipments and materials. Inspections are scheduled 
at intervals not to exceed six signee, An interview is held with each of 
the. contractor employees assigned éGniinteat ions duties and pertinent 
security requirements are reviewed. Any security deficiency that cannot 
be resolved during the visit is noted in the inspection report and prompt 
follow-up action is taken. 

Of primary concern to OC is the number of contractor personnel authorized 
access to cryptographic systems and materials. A recent decision to require 
the presence of two cryptographic cleared personnel during operation of the 
centers has required the granting of additional clearances. At the present 
time, Bl contractor personnel have access to Agency-sponsored contractor centers. 

OC has received approval of a plan to consolidate centers located in 
nearby areas and to provide message service to several contractors from one 
central location. Roving staff communicators working out of the consolidated 


centers will provide service, on a scheduled basis, to low volume contractor 
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centers within a 50-75 mile radius. PE «251 communicator positions STATINT 


have been approved to man the consolidated centers and provide roving 
communicator coverage. A task force composed of OC, 0S, OSO, OD&E, OWI, 

and OSI personnel has been established to implement the plan. Implementation 
will be phased over a two-year period with a target date for completion by 
the end of FY-79. Once the plan is implemented, all contractor communi- 


cations centers will be under the direct control of Agency staff personnel. 
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D. ORGANIZATION 

Industrial Security Officers (ISO's) are currently assigned to two major 
industrial security programs. One program involves Agency funded classified 
aeneeees and is under the technical purview of the Chief, Office of Logistics, 
Security Staff (C/OL/SS) with respect to advice, guidance and coordination. 

The other program involves non-Agency funded classified contracts and is 
under the purview of the Chief, Office of Development and Engineering, Security 
Staff (C/ODE/SS). 

To monitor the security of Agency funded contractual arrangements, the 
Director of Logistics has a Security Staff at Headquarters and a Security 
Officer i a In addition, activities of the 
Security Officers assigned to the decentralized contracting teams of the Office 
of Research and Development, Technical Service, SIGINT Operations, and the NFAC 
are under the technical security cognizance of the C/OL/SS. The ISO's monitor 
the security provisions written into Agency funded contracts. They receive 
their policy and procedural guidance from the C/OL/SS. 

The non-Agency funded program arrangement was formalized in 1962 by the 


STATINT 


establishment of the National Reconnaissance Office (NRO) which provides 


groups or projects report to the C/OD&E/SS but are located with and work for 


various project managers. One of these groups, the Development and Engineering 


@ Group (DEG) spends part of its time on Agency funded programs and part on non- 


Agency funded activities. All these individuals serve as ISO's as well as project 


and operational security officers. 
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There are no = who do not report through either the 


C/OL/SS or the C/OD&E/SS. These ISO's report directly to the Security Manage- 

ment Staff/DDS&T at Headquarters. There is no formal interface STATINTL 
with the Security Officer a the C/OL/SS 

with respect to the assignment of inspection responsibilities, the processing 

of personnel security approvals, or the submission of inspection reports. 

This unique situation should be corrected and is discussed further in the 


STATINT 


section of this report relating to Resources. 


A newly created Industrial Security Branch, with a T/O of <o- 


fessional security officers, will, by conducting periodic audits, provide the 
Director of Security and the contracting components with an independent 
evaluation of the security posture at all sensitive contractor sites. In 
addition, it will act as an Office of Security focal point for providing security 
advice and guidance to contracting components; establish an Industrial Security 
Officer's training program; and seek to establish uniform industrial security 
policies. However, this Branch will have no responsibility for the eoduee of 


STATINT 


periodic inspections. 


With. respect to the ISO's under the cognizance of the C/OL/SS, industrial 
security inspections of the contractor facilities are conducted and written 
reports submitted. Each of the Industrial Security Officers is allocated his 
own "stable" of contractors for which he has primary security inspection respon- 


sibility. 


2 
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As a general rule, there is no duplication of visits to the same contractor 
facility. However, in certain instances, when special projects are involve d 
exceptions may be made to the desired practice of having contractor interface 
with only one ISO relative to security policy matters. 

On the non-Agency funded programs, after the initial security requirements 

' have been implemented by a contractor the ISO is in periodic contact with the 
contractor for the purpose of monitoring the security of the project and he 
periodically visits the contractor facility. However, in-depth physical and 
procedural security re-inspections are not generally undertaken and therefore 
no formal security inspection reports are submitted. 


All project ISO's in this program clearly recognize that periodic security 


inspection and the submission of formal inspection reports are desirable, 
however the day-to-day activity of handling the operational security require- 
ments of various projects precludes such re-inspection. Therefore the lack of 
manpower has precluded the initiation of a formal re-inspection program. 

At the larger and often most sensitive contractor sites various ISO's 
assigned to these programs, plus those assigned to the Agency funded programs 
visit the same contractor and levy security requirements relative to different 


_ STATINT 


contractual arrangements. Currently there are SO's assigned to non-Agency 
gn 8 


STATINT 


ATINTL 
funded programs and they have cognizance of BR -ontractor facilities. Of the 


BRE contractor facilities, approximately Be 21:0 have Agency funded programs 
STATINT 


with ISO's who have separate contractual security responsibilities. 


One cognizant Industrial Security Officer per contractor facility or two 
@ per contractor facility, representing the Agency-funded and national program 


interests, is highly desirable. 


3 
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Finally, the current goal relative to inspection of contractor facilities 
is an annual visit for the purpose of conducting updated inspections or to close 
out contractors with whom contracts have been completed or settled. This annual 
re-inspection cannot be realized because of manpower constraints and corrective 


action with regard to the need for additional personnel is also discussed in 


relation to Fesources _ 
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Security Performance Standards 


Any examination of security performance by Agency contractors must 
begin with a review of performance standards and direction provided to 
the contractor. These standards and directions have their origin in 
security policy promulgated by the Director of Security through internal 
regulations incorporated in various security manuals and ultimately levied 
on the contractor thru the medium of the Agency's industrial contract&r. 
Such direction may, in accordance with contract terms, also be given:. 
orally by CIA Industrial Security Officers (ISO's) having cognizance for 
specific contracts or contractors. Discussion in this area requires that the 
overall role of the Office of Security with respect to the Agency's indus- 
trial security activity be considered as well as existing security practices 
for both Agency sponsored and national programs. 

© ef tect that the Director of Security is 
responsible for developing Agency policy and standards for the establishment 
and maintenance of security of Agency industrial contractual arrangements 
and that, consistent with the primary inspection responsibility of the 
Director of Logistics, the Office of Security will perform physical security 


inspections when deemed necessary. ———e states that the Director STATINT 


of Logistics will implement and insure adherence to the security policy 


and standards for industrial contractual arrangements published by the 


Director of Security. (There is no reference, per se, to the role of the 


DDS&T to whom the DCI has given special procurement authority.) The Office 
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of Security: 

a. Assigns professional ISO's to the two industrial 
security programs. 

b. Has established the criteria for the security approval 
of contractor employees. 

c. Conducts investigations and grants appropriate 
security approvals. 

d. Provides through the Special Security Center guidance 
relative to the establishment and accreditation of contractor 
SCI facilities. 

e. Provides a data bank of approved SCI facilities and 
personnel approved for SCI access. 

£. Provides through the Clearance Division a means for the 
certification of industrial security access approvals. 


Fro 


g. Smmivides guidance relative to the security of 


computer operations through the Information Systems Security 


Group. 
Howevér, there is gate focal point component within the Office of. Security 
whose duties encompass the discharge of the Director of Security's responsi- 
bility to develop and publish Agency security policy and standards for the 
establishment and maintenance of Agency industrial contractual arrangements, 
In the absence of such a focal point in the Office of Security with the 
necessary authorities and expertise in the industrial security field, 
industrial security policy and standards are Seacctaas generated by the 
Security Staffs of OL and OD&E, somewhat of a "tail wagging the dog" 
arrangement. The more serious consequence of this practice is some lack 


of uniformity in standards and direction provided to our contractorg. 
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aed. 
Security policy and standards for Agency programs have 


been developed by the Security Staff of the Office of Logistics and 
published, after review and approval. by the Director of sacierey: in the 
form of two industrial security manuals. The manuels are essentially 
the same, varying only in that one goes to contractors where association 
with the Agency is classified and one to contractors where it is not. 
Copies are given to contractors and incorporated by reference into a 
contract. 

Where Agency sponsored programs and national level programs enter into 
contracts involving SI/TKH material, they follow policy and standards 
developed by the Special Security Center of the Office of Security and ail 
published, after review and approval by the Director of Security, in an 

6 industrial security manual specifically tailored to Agency contracting. 
This SI/TKH manual is Pree ens ae the use of Agency employees. It is not 
given to contractors but weetinent portions may be furnished to contractors 
for their guidance and for inclusion in contracts where necessary. 

National level programs obtain the balance of their guidance con- 


STATINT 


cerning Gdgareial security policy and standards from the Special 

Security Center in the form of ne le 

which, after review and approval by the Director of Security, was published 

in order to establish guidelines, philosophy and requirements for safe- 
ATINTL guarding GE information in the possession of contractors. Copies of 

the manual. are incorporated into contracts by reference. 


Underlying:=the physical security standards in the ae... SI/TKH STATINT 


manuals is the USIB Physical Security Standards Policy Statement which 
provides "minimum standards" applicable to contractors. A representative 


of the Director of Security served on the USIB committee which produced 
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At the present time, the manuals ccntain some discrepancies in 
standards or requirements but, more importantly, each manual contains 
language like the following: 

"Specific requirements ... will vary from contractor to 
contractor ... the proper combination of techniques and the 
degree to which they will be employed can best be determined 
during the ... Security Representatives ... visits and 
inspection .... There are, however, certain ... minimum 
standerds which remain reasonably constant." 

"Protection ... can be accomplished in several ways by 
utilizing various security techniques and the degree to which 
theywill be erphasized can best be determined during ... visits 
.-. by security officers representing acceptable standards which 
remain reasonably constant..." 


i / 
"There is no set formula for the physical protection of 


a information ’*...." 


The language quoted above envisions permitting the ISO's to make 


independent judgements on site consonant with such considerations as cover, 


but because of a lack of specificity, creates an obstacle to enforcement 
of contract terms. A further equally serious problem results when 
different security manuals are provided to be contractor. Mr. Lapham, 
Agency General Counsel, noted in his 12 August 1977 memorandum to the 


ADDCI that both the manuals entitled "Security Requirements for Contractors" 


sponsored programs and national programs, were in use | Notwith- RtatNt 


standing the fact that these two manuals are not alike in all respects, 


| apparent Agency ISO acquiesence, elected to observe the 
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tequirements even in the performance of Agency contracts. 

The lack of uniformity in security standards and the fact that 
the SI/TKH manual cannot be provided to contractors has been recognized 
and a uniform security manual suitable for incorporation by reference 
into classified contracts and distribution to contractors is in prepara- 
tion. 

Less than specific language heretofore included in various security 
standards has permitted a good deal of flexibility to ISO's in their 
administration of contractor security programs. Even with the new, 
uniform, more specific single security manual it is envisioned that 
provisions must remain which allows ISO's to grant waivers or make changes 
as necessary for accomplishment of contract objectives. Such waivergor 
changes should be reported in writing.to the Director of Security and 


reviewed on a continuing basis. 
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Resources E 

For the purposes of this discussion the resources for administering 
the Agency Industrial Security Program fall primarily into two categories; 
those manpower and dollar resources required by the various Agency elements 
to properly administer an effective industrial security program at the 
contractor facilities, and those required by the contractors to 
effectively perform their security responsibilities. Before proceeding 
with a discussion of the impact of this additional security emphasis on 
resources, it is important to understand the current alignment of them, 
particularly in the manpower area. 

Current Industrial Security Command and Staff Relationships 
The two major industrial security programs, one involving Agency 
© funded classified contractual activity which generally is under the 

esis eer aantee of Chief, Logistics Security Staff with respect to 
advice, guidance and coordination; the other program involves non-Agency 
funded contractual activity which is under the purview of Chief, 
Office of Development and Engineering, Security Staff. 

The officers assigned to the two programs are professional security 
employees who provide industrial security support to Agency contracting 


offices, Agency technical representation, and representatives of the 


contractor. However, there are a number relative to policy and procedures 


in the two programs. 
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Office of Logistics, Security Staff 


The Office of Procurement and Supply, the predécessor of the Office 
of Logistics, formed a one man security staff in March of 1953 to provide 
industrial security support for classified procurement activity of this 
Agency. By 1956, the OL Security Staff (OL/SS) had expanded to five 


professional security career officers. An increase of the Agency's 


in 1961. In 1967 the Director of STATINT 
Logistics began implementation of a policy of decentralized procurement 
by establishing the first of a number of contracting teams composed 


of several contracting officers, an auditor and an ISO within various Agency 


STATINT 


components. Today, the C/OL/SS has .;.:. assigned to his staff to 


provide security support to OL and to components not covered by contracting 
teams. In addition there are ; assigned to contracting teams. 
The total professional manpower dedicated to this effort is ip 3a] (see STATINT 
attachment ~— Current Support of Agency Funded Contracts). 
Security Management Staff, 0/DDS&T 

In the early 1960's resident security officers were assigned to a 
number of the Office of Scientific Intelligence (OST) contractor facilities 
to monitor the security of external analysis SI/TK level projects. The 


continuing projects in this category ie The security 


officers for these projects continued their assignment to OSI and responded 
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to the direction of the Headquarters OSI security officer until June 1970 


STATINT 


when the latter's slot was abolished. Direction of these two security 


a: then assigned to the Chief, Security Management Staff 


(C/SMS/DDS&T). Since that time, they have taken over the security 
responsibility for other Agency funded contractor facilities when SI/TK 
level activity is conducted. During this period, some of these projects 
were transferred from OSI to the Office of Weapons Intelligence (OWI). 

In November 1976, both of these offices, OSI and OWI were transferred to 
the Intelligence Directorate, now NFAC. The current DDS&T manpower 
allocated to this effort is 2.-(see attachment - Current Support to Agency 


Funded Contracts) 


STATINT 


A major portion of the additional manpower augmentation is for iz 


Industrial Security Officers to be assigned Fy pc industrial 

security elements (Agency funded programs) and the Security Staff of 

ODE (non-Agency funded programs). The proposed manpower resources for 

these activities are presented in Tables 1 and 2. These increases are 
absolutely essential if we are to administer an effective industrial security 
program which insures that the contractor is responding to our security 
standards and performance requirements. These increases will improve 

our day-to-day visibility into the contractor's security performance 

against the more comprehensive standards the contractor is being 


directed to enforce. 
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Increased espionage efforts in the U.S. of the Soviets and other 
foreign intelligence services has been a topic of constant discussion over 
the last few months. The ues cieedane oe the Boyce/Lee case and Presi- 
dential concern about the security of the U.S. telecommunications links 
have made it evident that a change in our industrial security posture 
is required. We can no longer just be concerned about physical personnel 
and document security but must take an aggressive approach in the areas 
of Counterintelligence and Audio Countermeasures. The D/OS should be 
instructed to proceed to develop and mount an ACM program and increase 
his liaison activities in the industrial CI field with the FBI. It 
is estimated that a program for ACM inspection of Wh ensitive CIA and 
the BI-annual inspection off «her contractor facilities would 
cost: 

a. equipment 
b. travel 
Cc. personne1 (@) 


Although the start-up cost in equipment for this effort is high, the 


potential for detecting or preventing a disaster worse than the Boyce/ 
Lee case is evident. 

We anticipate contractual cost increases as the contractors initiate 
improved enforcement of their industrial security responsibilities, parti- 
cularly during the implementing phase when they are bringing their 
facilities and security procedures a to a leveleconsistent with the more 


demanding secutity requirements we are imposing. This will, of course, 


> 
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result in a moderate increase in the cost of goods and services in most 
instances, which must be borne by the sponsoring elements. The Agency's 
contracting authorities will insure that the contractor's charges for 
security performance continue to be reasonable. 

It is not possible to make accurate estimates of the level of these 

ConresctTual 
added,costs until we have had an opportunity to study cost data submitted 
by contractors, As stated earlier, the added costs for increased 
security performance will be relatively high during the implementation phase, 
then stabilize at a lower level after existing deficiencies are corrected. 

PMPLe man rei Foo ad 

After the jimpkementary phase we would not expect this added cost to 
exceed about 1% of the contract cost, although it should be pointed out 
that contract value is not necessarily a direct measure of secutity 
performance costs. 

We unanimously believe that the additional security protection 


afforded is adequate justification for the expenditure of the 


additional manpower and dollar resources involved. 
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